東華大學圖書館 |

Language: English

Help

回圖書館首頁

手機版館藏查詢

Back

Switch To: Labeled | MARC Mode | ISBD

Investigating the Latent Security an...

Kafle, Kaushal,

Linked to FindBook

Google Book

Amazon

博客來

Investigating the Latent Security and Privacy Risks in Consumer-Oriented Software Systems /

Record Type:	Electronic resources : Monograph/item
Title/Author:	Investigating the Latent Security and Privacy Risks in Consumer-Oriented Software Systems // Kaushal Kafle.
Author:	Kafle, Kaushal,
Description:	1 electronic resource (177 pages)
Notes:	Source: Dissertations Abstracts International, Volume: 86-03, Section: A.
Contained By:	Dissertations Abstracts International86-03A.
Subject:	Computer science. -
Online resource:	https://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=31329409
ISBN:	9798384104865

Investigating the Latent Security and Privacy Risks in Consumer-Oriented Software Systems /
Kafle, Kaushal,

Investigating the Latent Security and Privacy Risks in Consumer-Oriented Software Systems /Kaushal Kafle. - 1 electronic resource (177 pages)

Source: Dissertations Abstracts International, Volume: 86-03, Section: A.

Consumer-oriented software systems have become the foundation on which consumer data is collected and transported from the consumers to the data processors. They are complex, with various interconnected, heterogeneous components working together, making their security and privacy analysis challenging, and impact on the user uncertain. In this work, we first explore how security threats can arise in novel context in such systems by performing a security evaluation of data-store based smart home platforms and the overall security risks posed by the design of routines within such platforms. We analyze various components of the smart home such as the platform's permission enforcement mechanism and the apps/services that connect to the smart home that are used during the creation and execution of routines. We find that 1) platform's permission enforcement and access control model may be broken and allow for attacker's to bypass user's consent to perform privileged tasks, 2) around 20% of apps that connect to smart home platforms may have vulnerable SSL connections, and 3) lateral privilege escalation in smart home platforms is possible with the help of routines, wherein we demonstrate by compromising a smart home camera by escalating our privilege gained with a smart home switch app. Secondly, to develop a practical defense against the threats introduced by the routines, we leverage the unique opportunity provided by the smart home i.e., validating incoming state change requests by comparing with the observations gathered by physical devices connected to the platform, for enhancing integrity in smart home platforms. Using this insight, we propose HomeEndorser, which is a practical framework to provide integrity guarantees to smart home platforms. To do so, HomeEndorser endorses (or rejects) requests by apps or services to modify Abstract Home Objects (AHOs) such as home or fire by enforcing integrity policies based on the current state of devices in the home. By protecting against malicious modifications of AHOs, HomeEndorser is able to prevent arbitrary privilege escalation attacks that were possible by exploiting routines. Finally, to understand how effectively stakeholders convey security and privacy risks to the users, we designed the Polityzer framework to systematically analyze the privacy postures of election campaign websites. Using Polityzer, we find a vast majority of election campaign websites lack a privacy disclosure, and even in cases where privacy policies were provided, they were often incomplete. We also found that campaigns may be inadvertently sharing data with other campaigns through common fundraising platforms, without disclosing such sharing.

English

ISBN: 9798384104865Subjects--Topical Terms:

523869
Computer science.
Subjects--Index Terms:

Privacy practices

Investigating the Latent Security and Privacy Risks in Consumer-Oriented Software Systems /
LDR:04246nmm a22004453i 4500 001 2430770
005 20250603111613.5
006 m o d
007 cr|nu||||||||
008 261011s2024 miu||||||m |||||||eng d
020 $a 9798384104865
035 $a (MiAaPQD)AAI31329409
035 $a AAI31329409
040 $a MiAaPQD $b eng $c MiAaPQD $e rda
100 1 $a Kafle, Kaushal, $e author. $0 (orcid)0000-0003-1917-7677 $3 3819260
245 1 0 $a Investigating the Latent Security and Privacy Risks in Consumer-Oriented Software Systems / $c Kaushal Kafle.
264 1 $a Ann Arbor : $b ProQuest Dissertations & Theses, $c 2024
300 $a 1 electronic resource (177 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Dissertations Abstracts International, Volume: 86-03, Section: A.
500 $a Advisors: Nadkarni, Adwait Committee members: Poshyvanyk, Denys; Evtyushkin, Dmitry; Herwig, Stephen; Singh, Kapil.
502 $b Ph.D. $c The College of William and Mary $d 2024.
520 $a Consumer-oriented software systems have become the foundation on which consumer data is collected and transported from the consumers to the data processors. They are complex, with various interconnected, heterogeneous components working together, making their security and privacy analysis challenging, and impact on the user uncertain. In this work, we first explore how security threats can arise in novel context in such systems by performing a security evaluation of data-store based smart home platforms and the overall security risks posed by the design of routines within such platforms. We analyze various components of the smart home such as the platform's permission enforcement mechanism and the apps/services that connect to the smart home that are used during the creation and execution of routines. We find that 1) platform's permission enforcement and access control model may be broken and allow for attacker's to bypass user's consent to perform privileged tasks, 2) around 20% of apps that connect to smart home platforms may have vulnerable SSL connections, and 3) lateral privilege escalation in smart home platforms is possible with the help of routines, wherein we demonstrate by compromising a smart home camera by escalating our privilege gained with a smart home switch app. Secondly, to develop a practical defense against the threats introduced by the routines, we leverage the unique opportunity provided by the smart home i.e., validating incoming state change requests by comparing with the observations gathered by physical devices connected to the platform, for enhancing integrity in smart home platforms. Using this insight, we propose HomeEndorser, which is a practical framework to provide integrity guarantees to smart home platforms. To do so, HomeEndorser endorses (or rejects) requests by apps or services to modify Abstract Home Objects (AHOs) such as home or fire by enforcing integrity policies based on the current state of devices in the home. By protecting against malicious modifications of AHOs, HomeEndorser is able to prevent arbitrary privilege escalation attacks that were possible by exploiting routines. Finally, to understand how effectively stakeholders convey security and privacy risks to the users, we designed the Polityzer framework to systematically analyze the privacy postures of election campaign websites. Using Polityzer, we find a vast majority of election campaign websites lack a privacy disclosure, and even in cases where privacy policies were provided, they were often incomplete. We also found that campaigns may be inadvertently sharing data with other campaigns through common fundraising platforms, without disclosing such sharing.
546 $a English
590 $a School code: 0261
650 4 $a Computer science. $3 523869
650 4 $a Home economics. $3 551902
650 4 $a Political science. $3 528916
650 4 $a Information science. $3 554358
653 $a Privacy practices
653 $a Security and privacy
653 $a Smart home platforms
653 $a Election campaigns
653 $a Consumer-oriented software systems
690 $a 0984
690 $a 0723
690 $a 0615
690 $a 0386
710 2 $a The College of William and Mary. $b Computer Science. $e degree granting institution. $3 3819261
720 1 $a Nadkarni, Adwait $e degree supervisor.
773 0 $t Dissertations Abstracts International $g 86-03A.
790 $a 0261
791 $a Ph.D.
792 $a 2024
856 4 0 $u https://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=31329409